Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

221–230 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#221

Post by flukus »

whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

He didn't walk in and take something, he sent a request (via HTTP) and they responded with the content he requested.

If I sent them a dead tree letter requesting a document and they replied with a copy of that document, would you consider this the equivalent of going into their house and taking their TV?

Re: Teenager facing prison for downloading unsecured files from government website

#222

Post by defined »

rayiner wrote: post #186
iak8god wrote: post #149

Earlier quoted context omitted.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

I disagree, because the analysis is faulty.

Computers always do what you _tell_ them to do, not what you want them to do.

The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to publicly accessible, and the entire site was meant to be publicly accessible. One can close the analysis until the cows come home, it will not change this fact.

Accessing that material is as illegal as finding a diamond ring (or personal files) while dumpster diving. Dumpster diving may be seen as tasteless or low-class, but as far as I know, it’s not illegal.

Do we prosecute reporters for ferreting out publicly available, yet embarrassing, information?

Re: Teenager facing prison for downloading unsecured files from government website

#223

Post by dennisgorelik »

After figuring out that they screwed up, government agents should have politely visit the teen, interview him, go through his computer together and delete compromised files.

Then quietly fix the vulnerability.

Instead they produced PR disaster by disrupting lives of a law-abiding family.

These are signs of arrogance and incompetence of decision makers at that government department.

Re: Teenager facing prison for downloading unsecured files from government website

#224

Post by ljm »

munk-a wrote: post #212
Declanomous wrote: post #126

Earlier quoted context omitted.

It's not necessarily a problem that the older generation can only think about technology in a metaphorical sense, the problem is that the metaphors they are using are idiotic. I think, by and large, people are constrained to thinking about things they can describe. To that extent, being able to accurately describe something is meaningful, and is therefore a linguistic issue. Semantics are very important when you are…

Maybe we need to shift the metaphor. A situation like this (security wise) isn't like leaving a window unlocked and having someone rob your house it's like 1. Leaving a pie on the window sill overhanging the side walk with paper plates and plastic utensils beside it. 2. A man knocking on your door, asking you for your bank account number without impersonating anyone of authority, you offering it up freely, then suing…

The problem is the metaphor itself. The metaphor avoids the problem by providing a more trivial or palatable debate, it takes the attention away from the teen in trouble to the definition of the problem and at that point you've stopped caring about the person, you're caring about the problem.

This guy facing prison doesn't give a shit about it feeling like a man stealing a pie from your window. It's nothing close to that because you can steal pies from windows and be held accountable in a much more reasonable way, and trying to reframe the situation only helps to an extent.

Re: Teenager facing prison for downloading unsecured files from government website

#226

Post by Someone1234 »

thisacctforreal wrote: post #44
Someone1234 wrote: post #29

Earlier quoted context omitted.

Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

I think a cryptographic hash is fine. If you know the hash, you likely already know the file.

A cryptographic hash of what?

Cryptographic hashes aren't random by nature.

Re: Teenager facing prison for downloading unsecured files from government website

#227

Post by shkkmo »

rayiner wrote: post #169
jopsen wrote: post #155

Earlier quoted context omitted.

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn'…

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable pe…

> The fact that content on a website meant for the public to access is only accessible by "programmatic" means that ordinary users would not know, is strong evidence that the owners of the web server did not intend for people to access those documents

Sorry, that is complete BS. Have you scanned the entire internet and sure sure there are no links to these files on other public pages?

Files publicly hosted by a web server (software explicitly designed and installed to make those files public) is in no shape or form private property.

Furthermore, in this specific case, there is an explicit statement saying the files are public and saying nothing about them not being accessible:

"The Access to Information website allows you to submit, pay and receive FOIPOP requests online. The Nova Scotia Government also posts responses to formal FOIPOP requests online on the Disclosure log. This is a free public repository of FOIPOP responses that have been approved for publication and have met a specific set of criteria (PDF file 800 KB)."

https://novascotia.ca/is/programs-and-services/information-a...

Re: Teenager facing prison for downloading unsecured files from government website

#228

Post by hunter2_ »

samplatt wrote: post #133
whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

The 'locking the door' metaphor is just flat-out incorrect. A public-facing webserver is simply not a place to store your shit.. A closer analogy would be two tables out the front of your house covered in fruit, with a sign saying "Free Fruit" on one table and then expecting people not take fruit from the other table.

I like this analogy a lot. But I think even better would be someone setting up a store in an area advertised like "everything is included with the price of admission" (admission being your ISP fee) and taking from the store without realizing it's not truly all inclusive. The store needs to be a vending machine, not a shelf.

Re: Teenager facing prison for downloading unsecured files from government website

#229

Post by rayiner »

jessaustin wrote: post #180
rayiner wrote: post #153

Earlier quoted context omitted.

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech ), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical. The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly access…

Phones, bullhorns, billboards, postcards, bumper stickers, guitars, TV transmitters, etc. are dumb pieces of property that people use to communicate. (Why don't I have to get permission to look at your billboard?) Computing devices are different from most of these in a single respect: they can act autonomously, as their operators intend. In fact it is customary that they do so, just as it is customary that billboards…

> There's nothing anthropomorphic about recognizing that intent may be coded in such a way that a computer obeys that intent.

What a computer does may be evidence of intent, just as a lock (or lack thereof) may be evidence of intent. But just like an unlocked door is not evidence of intent to make something accessible, neither is an unlocked computer.

> Consider, if you will, whether your preferred position is one that will lead to improvements.

The Internet belongs to ordinary people, not folks who have read the HTTP spec. (It's their world, we just live in it.) "Improvements" will be had when the rules comport with what ordinary people want and expect. Ordinary people don't think about computer security; they expect that, like in the real world, people won't go into places that don't look like they're meant for the public just because there's no locks to prevent them from doing so. The law should reflect those expectations.

Laws exist to create social norms. HN users are preoccupied with data security, but ordinary people hate security measures and are bad at it. So it seems completely backward to me to codify in the law the idea that accessing data should be presumed to be permissible just because the owner of the data didn’t secure it.

Re: Teenager facing prison for downloading unsecured files from government website

#230

Post by cnniris393 »

munk-a wrote: post #193
winthrowe wrote: post #22

Earlier quoted context omitted.

Information accessible here was SUPPOSED to be all public, with sensitive information located elsewhere, however a handful of improperly redacted documents were also published to the site. Here's a more technical article: https://evandentremont.com/some-information-on-the-freedom-o...

So this is a classic case of a subcontractor doing substandard work, leaving a security hole big enough to drive a truck through, and then trying to sue someone to save face... Sigh. If some of those documents weren't appropriate to be viewed by the general populace then the company was criminally negligent in their handling of the data, the "hacker" saw an open door with a sign reading "free information" on it and d…

And the cries by old geezers in charge, yet clueless of what it is they’re “in-charge of”, that he stole it are eye rolling

It’s ageism but at this point I’m pretty convinced old people should be term limited from office

The problems we seem to be facing are almost entirely due to their inability to move on

Youth shouldn’t spend their lives kowtowing to geezers that quit thinking and are simply peddling what’s become etched in their neurons and “the rules”

Post reply on HN